How long it takes to move up one AI governance maturity level

Why a single number is not credible

There is no verified universal duration for advancing one AI governance maturity level. How long a level takes depends on which workstreams sit on the critical path, so any single figure that ignores your current baseline and dependencies should not be treated as a reliable estimate.

Workstreams that gate a level advance

Five workstreams determine whether a level can be declared reached. The slowest of them usually sets the pace.

Factors that lengthen or shorten a level advance

Based on the workstreams above, the duration of a level advance is shaped by:

• Your current baseline in each workstream: inventory, policy ownership, identity and permissions, runtime enforcement, and audit evidence.
• The slowest dependency among those workstreams, which sits on the critical path.
• Whether the evidence that shows the level has been reached is defined in advance.

Phases of a single level transition

A level transition can be planned as a short sequence:

1. Size each workstream against your current baseline.
2. Find the slowest dependency to identify the critical path.
3. Define the exit evidence in advance, so the target is testable.
4. Confirm the level by checking the collected evidence against that definition.

Estimating a realistic range for your organization

Estimate a range rather than a single date. Size each workstream against your current baseline, find the slowest dependency, and let that dependency bound the range. Then define the evidence that will show the level has been reached, so the estimate has a clear finish line.

Where runtime enforcement changes the work

Runtime enforcement applies policies when agents act, not only when the policies are written. That changes the work: the evidence now includes control test results showing that policies were enforced during operation, and audit logs that record agent actions, tool use, and approval decisions.

Evidence that shows a level has been reached

Use the following as the exit evidence for a level:

• An inventory of AI systems and agents with owners, last-reviewed dates, and a documented update process
• Policies with named owners, approval records, and a review schedule
• Agent identities and permission scopes that can be listed and reviewed
• Control test results showing that policies were enforced during operation, including blocked or escalated actions
• Audit logs that record agent actions, tool use, and approval decisions, with defined retention
• Review records showing exceptions were raised, decided, and closed